Vietnam Identity | Law AesirX ComplianceOne

Why the Vietnam Identity Law Matters

If your organization relies on identity data, electronic identification or authentication in Vietnam, your obligations start with the Identity Law 26/2023/QH15. It covers citizen identity, the identity card and the identity database, and it is the legal basis for electronic identification. It took effect on 1 July 2024 and is in force today.

Two instruments sit beneath it, and they do different jobs:

Decree 69/2024/NĐ-CP is the implementing decree for electronic identity accounts and their authentication levels. It is the part of the stack that prescribes official forms.
Project 06 (Đề án 06) is a national programme that applies population data and electronic identification to public and private services. It shapes how you integrate with the population database and VNeID, but it is a programme, not a regulation that imposes direct obligations.

Decree 320/2026/NĐ-CP, issued on 13 August 2026 and effective 28 September 2026, amends and supplements Decree 69; the two decrees are read together. It:

opens electronic identification accounts to foreigners lawfully in Vietnam and to organizations registered here;
stops agencies and organizations from demanding a document already integrated into the National Identification Application;
requires electronic transaction accounts in twelve named sectors to be linked and authenticated with an electronic identification account.

The Draft Law on Electronic Identification and Authentication is not part of this stack. It is a consultation draft, not enacted law, and ComplianceOne tracks it separately as readiness work.

Each layer needs different handling. Decree 69 obligations need execution and evidence today. Project 06 integrations need mapping as dependencies, not as obligations. Draft provisions need watching without being treated as binding. ComplianceOne keeps the layers connected and keeps each one at its own legal weight.

What the Vietnam Identity Law Covers

Dimension

Coverage

Parent framework

Law 26/2023/QH15 on Identity: passed 27 November 2023, effective 1 July 2024. Covers identity information, the identity card and the identity database.

Active implementing decree

Decree 69/2024/NĐ-CP on Electronic Identification and Authentication: issued 25 June 2024, effective 1 July 2024. It replaced Decree 59/2022/NĐ-CP.

Decree 320/2026/NĐ-CP: issued 13 August 2026, effective 28 September 2026, amends and supplements Decree 69 rather than replacing it.

National programme

Project 06 (Đề án 06), approved by Decision 06/QĐ-TTg of 6 January 2022, covering 2022–2025 with a vision to 2030.

Who it applies to

Organizations that rely on identity information, electronic identification, authentication or verified state data.

What you manage

Identity lifecycle; authentication evidence; controlled reuse of verified state data; population-database and VNeID dependencies.

Evidence

Attribute inventories, lifecycle records, authentication logs, approvals and dependency maps.

Official forms

Seven verified Decree 69 forms: TK01, TK03 and XT01 to XT05. Neither the Identity Law nor Project 06 prescribes a verified official form.

Sector linkage deadlines

Before 31 December 2026 for national digital platforms and covered non-banking accounts, so the last day is 30 December 2026. Before 30 June 2027 for banking-sector accounts created before 28 September 2026, so the last day is 29 June 2027. Both are set by Article 20(3) of Decree 320/2026/NĐ-CP.

Cross-border pilot plan

Decision 1830/QĐ-TTg of 22 September 2026: a State plan to pilot connecting VNeID with Singapore's Singpass and Laos's LAeID. It directs ministries and creates no duty for, and no access by, a private organisation.

Legal status

The law, Decree 69, and Decree 320 are in force, the Decision 1830 pilot plan is a reference, and the draft law is tracked separately. Each sits on its own layer.

The Identity Law Instrument Stack

Decree 69/2024/NĐ-CP

Active Implementing Decree

Decree 69 is where the day-to-day identity obligations sit. It governs electronic identity accounts and the authentication levels that apply to them. It is the only instrument in this stack with verified official forms:

TK01 and TK03: applying for an electronic identity account, and locking or unlocking an account or card.
XT01 to XT05: confirming eligibility for an electronic authentication service, amending it, revoking it and reporting on activity.

Explore Decree 69 Compliance

Decree 320/2026/NĐ-CP

Active

Decree 320 amends and supplements Decree 69 from 28 September 2026. Most of its twenty articles rewrite numbered articles of Decree 69, so each obligation is cited to both decrees. It:

widens who may hold an electronic identification account;
synchronises issued documents automatically from connected databases;
requires access history to be kept and shown back to the identity subject;
revises the procedure for confirming an electronic authentication service;
introduces the sector linkage obligation with its two deadlines.

It prescribes no new form. TK01, TK03 and XT01 to XT05 still apply; what changed is the procedure behind them.

Explore Decree 320 Compliance

Project 06 (Đề án 06)

Official National Programme Reference

Project 06 is Vietnam's national programme for applying population data and electronic identification to public and private services. The Prime Minister approved it by Decision 06/QĐ-TTg, signed on 6 January 2022.

Its full English title is the Scheme on developing the application of population data, identification and electronic authentication in service of national digital transformation for the 2022–2025 period, with a vision to 2030. The Vietnamese title is Đề án phát triển ứng dụng dữ liệu về dân cư, định danh và xác thực điện tử phục vụ chuyển đổi số quốc gia giai đoạn 2022 - 2025, tầm nhìn đến năm 2030.

For compliance teams, Project 06 is the integration layer: the programme under which services connect to the population database and to VNeID. ComplianceOne tracks one obligation against it. You map the population-database, VNeID and public-service integrations your organization depends on, with the evidence behind each.

Project 06 prescribes no verified official forms and imposes no direct filing or sanctions obligations. ComplianceOne treats it as reference material within the Identity Law stack, and records you create for it are labelled as internal working documents.

Source: Decision 06/QĐ-TTg, 6 January 2022, Prime Minister of Vietnam.

Decision 1830/QĐ-TTg – Cross-Border Pilot Plan

Reference Only

Decision 1830/QĐ-TTg, in force since 22 September 2026, issues the Government's plan to connect VNeID with Singapore's Singpass and Laos's LAeID. It includes a pilot at Nội Bài and Tân Sơn Nhất airports from 15 November to 15 December 2026. It binds the Ministries of Public Security, Foreign Affairs, and Science and Technology.

It is not an implementing instrument of the Identity Law and does not cite it, Decree 69 or Decree 320. It places no duty on a private organisation and gives none access to any of the three systems. ComplianceOne keeps it as a reference with ministry milestones, apart from the duties above. An optional register lets an organisation that expects to rely on cross-border identity model a flow and hold it out of production until its evidence is recorded.

Draft Law on Electronic Identification and Authentication – Separate Track

Draft

The draft law is not part of the active stack. It neither amends nor replaces Law 26/2023/QH15 or Decree 69. ComplianceOne tracks it as separate readiness work, so draft provisions never mix with current obligations or evidence.

Explore Electronic Identity and Authentication Draft Readiness

How ComplianceOne Supports the Vietnam Identity Law

Keep one governed identity inventory instead of a spreadsheet.

For each attribute your organization processes, record where it came from, the lawful basis for using it and which verified state data it links to. Reuse of verified state data carries its legal basis, source and traceability on the record.

Record the check, never the value.

The register has no field for a personal identification number, a date of birth or a tax reference, and it stores no hash of one either. These values come from small, structured ranges, so a hash can be reversed by trying candidates until one matches.

Instead, each record shows that a verification happened:

which attribute type was checked, and which issuer asserted it;
which method was used, when, and with what result;
a protected attachment where the underlying document lives.

Work from the decree's own lists.

Once Decree 69 is added to your workspace, ComplianceOne offers its 19 regulated attribute types (eight of them restricted), its ten verification methods and its four ranked authentication levels. When the decree changes, the update reaches your workspace without a product change.

Run Decree 69 work in one place.

The seven official forms, the electronic identity account lifecycle and authentication evidence sit in one workspace. Account creation, activation, change, suspension and termination keep their evidence attached. Authentication records keep the method, result, time and relying service, so you can answer an audit question from the record.

Map Project 06 dependencies.

Record your population-database, VNeID and public-service integrations with the evidence behind each. This is documentation and evidence, not a production connection to VNeID.

Apply the Decree 320 amendments.

Decree 320 sits beneath Decree 69 as an active amendment. Each obligation names both the amending article and the Decree 69 article it changes. The two linkage deadlines are tracked separately against the accounts they cover. The two appendix lists of integrable document types are available as reference lists, not as forms to fill in.

Where identity evidence also serves personal data protection, data governance or cybersecurity work, you can link the same records to those obligations. Each record keeps its original framework and audit history.

Related Modules

Data Mapping

Maintains identity attribute inventories, source systems, and population-database or VNeID dependency records.

Explore Data Mapping

Compliance Forms

Supports the seven official Decree 69 forms and keeps internal lifecycle records clearly separate.

Explore Compliance Forms

Access & Accountability

Connects authentication events and account lifecycle changes to accountable owners and approvals.

Explore Access & Accountability

Audit Trail

Preserves contributor, review, approval, and evidence history across the identity stack.

Explore Audit Trail

Program Governance

Assigns ownership and recurring review across the active instruments and the separate draft-readiness track.

Explore Program Governance

Compare the Difference

Without Structured Framework Operations

With ComplianceOne

Current law and draft proposals are easily conflated.

Keep active and draft identity frameworks distinct.

Authentication events lack consistent evidence.

Link authentication events to accountable records.

VNeID and state-data dependencies are undocumented.

Map VNeID and verified-data dependencies with review history.

Integration dependencies are inconsistently tracked.

Track integration dependencies with clear ownership.

Required forms are disconnected from supporting evidence.

Connect required forms with supporting lifecycle evidence.

Identity records create unnecessary data duplication.

Record verification evidence without duplicating identity data.

Built for Identity Law Compliance Operations

Status, legal scope, and framework relationships remain visible throughout identity workflows, helping teams distinguish active obligations from draft readiness.

Official identity records, authority-issued artifacts, VNeID dependencies, and internal operational evidence retain clear source labels and legal context.

Contributor, reviewer, approval, authentication, decision, and evidence history stay connected across identity lifecycle activities for audit and regulatory review.